In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free. Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://git.kernel.org/stable/c/35483c5306e09b3190ff937089d404a78012695c cve-icon cve-icon
https://git.kernel.org/stable/c/5c1560be8aa6849356455af67518d35c551cbd95 cve-icon cve-icon
https://git.kernel.org/stable/c/79e12c891940b0c4c75881b7fd82a8cbb8ac97be cve-icon cve-icon
https://git.kernel.org/stable/c/93ed4692f2299a40346025979f40e4a9b7b33af7 cve-icon cve-icon
https://git.kernel.org/stable/c/a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2 cve-icon cve-icon
https://git.kernel.org/stable/c/d94e2947203aead590fd63f667d316d4475d65af cve-icon cve-icon
https://git.kernel.org/stable/c/e440e077748939839d9f76e24383b76b785f80ce cve-icon cve-icon
History

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free. Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.
Title vduse: hold vduse_lock across IDR lookup in open path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:58:12.058Z

Reserved: 2026-08-15T05:44:03.883Z

Link: CVE-2026-74313

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:31.460

Modified: 2026-08-15T06:22:31.460

Link: CVE-2026-74313

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T12:30:07Z